---
created: 2026-04-12T17:00:30.177Z
title: Add tool limitations to Psyche sessions
area: psyche
files:
  - src/live/psyche.rs
  - psyche.md
---

## Problem

Psyche sessions currently run as full Claude Code sessions with unrestricted tool access. This is overkill and risky — Psyche doesn't need Bash, filesystem exploration, or most tools. It should be a constrained companion that reads/writes only its own context and memformat files, not a general-purpose agent.

Additionally, Psyche currently lacks a structured output protocol for communicating back. When it wants to reply to an incoming message or notify Self, there's no standardized format — the psyche wrapper needs to know what action to take based on Psyche's output.

## Solution

Restrict Psyche's tool access to **Edit** and **Read** only, scoped to psyche context and memformat files. No Bash tool, no filesystem exploration.

Add structured output conventions for Psyche's turn endings:
- **`[REPLY]`** — When Psyche wants to reply to an incoming message, it ends its turn with output formatted as `[REPLY]` followed by the reply content. The psyche wrapper handles delivery.
- **`[NOTIFY]`** — When there was no incoming message but Psyche wants to message Self, it ends its turn with output formatted as `[NOTIFY]` followed by the notification content. The psyche wrapper handles delivery.

This complements the older todo about limiting how Psyche replies to communes — together they define the full constraint model for Psyche's interaction surface.